Bind a manual sign-off to the tree it was given against

F63, found live on run 19. A manual check on these projects is a human
reading what the code prints. RecordPlanPhaseVerification asked only
whether a sign-off for that plan and phase existed, and one exists forever,
so rerunning a phase's automated checks at a new commit carried the human
half along with it. The rig proved it twice: two operator commits and two
re-verification requests, each coming back verified without anyone looking.

The reducer now records which tree the human confirmed, the record carries
it forward as provenance, and a run whose commit does not match it waits
for the human again. A sign-off given before any run has no confirmed tree
and still counts, so the ordinary ordering is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/store/store.go

@@ -272,6 +272,9 @@ func (s *Store) apply(e domain.Event) error {
 				}
 				if p.Subject == domain.PlanPhaseSubject(rec.PlanRef, rec.PhaseID) {
 					t.PlanProgress.Phases[i].Status = domain.PlanPhaseVerified
+					// Record which tree the sign-off was about, so a later run
+					// at a different commit cannot inherit it (F63).
+					t.PlanProgress.Phases[i].ManualAtSHA = rec.AtSHA
 					t.Version = e.Version
 					s.replaceTask(e.TaskID, t)
 				}